Hacking probes everywhere....

alien51 · 06-17-2011, 09:40 AM

For several weeks now, my Cpanel logs are getting flooded by probing attacks from apparent hackers who seem to be searching if you have wordpress or joomla installed on your domains.

And they come from all sorts of countries. My banned ip address list on my htaccess is so long already. It's eating up too much of my time just checking the logs each day for all my domains. I sometimes wonder whether these are zombie machines (users who had no idea their computers are infected and being used for probing attacks).

maxeaus · 06-17-2011, 09:51 AM

Botnets, is that what you are saying?

vc · 06-17-2011, 10:00 AM

Use Drupal

lothos · 06-17-2011, 10:34 AM

Originally Posted by alien51

I sometimes wonder whether these are zombie machines (users who had no idea their computers are infected and being used for probing attacks).

it's automated, but not necessarily a zombie machine.

alien51 · 06-17-2011, 06:38 PM

I'm not sure if being "automated" means the guy who owns the machine where the IP address originated was unaware that the probing came from his IP.

I'm not sure anymore if i need to block all these IP addresses, or just let the 403 errors as they are (my htaccess settings prevent execution of php scripts in certain directories).

I've been blocking IP addresses almost everyday.

CrackFeed.Com · 06-22-2011, 01:06 PM

Originally Posted by vc

Use Drupal

Drupal sucks too. Use custom

defaultuser · 06-22-2011, 01:50 PM

Originally Posted by DomainerHelper

Drupal sucks too. Use custom

Use Bricks and Mortar

CrackFeed.Com · 06-22-2011, 02:22 PM

loll would perform faster than Drupal and Joomla

shootdatarget · 06-23-2011, 01:53 PM

Originally Posted by alien51

I'm not sure if being "automated" means the guy who owns the machine where the IP address originated was unaware that the probing came from his IP.

I'm not sure anymore if i need to block all these IP addresses, or just let the 403 errors as they are (my htaccess settings prevent execution of php scripts in certain directories).
????: NamePros.com http://www.namepros.com/warnings-and-alerts/719319-hacking-probes-everywhere.html

I've been blocking IP addresses almost everyday.

nice topic bro, even my VPS been port scanned at least 20 times per weeks and sometimes SQL injections, luckily i use Mode security and Csf at my WHM so it automatic block ips, cannot imagine if they use my vps for thier DDOS attack scheme which what that always happen around us ><

herly · 06-30-2011, 07:56 PM

Can only pray don't let hackers target. Because that's a very fearful thing, what will become of very bad.

Peter · 07-09-2011, 04:09 AM

Originally Posted by shootdatarget

nice topic bro, even my VPS been port scanned at least 20 times per weeks and sometimes SQL injections, luckily i use Mode security and Csf at my WHM so it automatic block ips, cannot imagine if they use my vps for thier DDOS attack scheme which what that always happen around us ><

20 a week? That is extremely low. In the past I have had my server attacked. It was not the attack that brought the server down it was the firewall. So many IP's were being blocked the server could no longer handle the size of the file that the blocked IP's were stored in.

---------- Post added at 12:09 PM ---------- Previous post was at 12:06 PM ----------

Originally Posted by alien51

For several weeks now, my Cpanel logs are getting flooded by probing attacks from apparent hackers who seem to be searching if you have wordpress or joomla installed on your domains.
????: NamePros.com http://www.namepros.com/showthread.php?t=719319

And they come from all sorts of countries. My banned ip address list on my htaccess is so long already. It's eating up too much of my time just checking the logs each day for all my domains. I sometimes wonder whether these are zombie machines (users who had no idea their computers are infected and being used for probing attacks).

It is almost certainly automated. Don't assume however that all checks are carried out by the same people. Many people out there are trying to exploit vulnerable scripts.

1 thing that does surprise me by the sound of it they are manually scanning for wordpress etc. If I were doing this I would personally hook into search engine results to find wordpres installations.

shootdatarget · 07-09-2011, 05:09 AM

Originally Posted by Peter

20 a week? That is extremely low. In the past I have had my server attacked. It was not the attack that brought the server down it was the firewall. So many IP's were being blocked the server could no longer handle the size of the file that the blocked IP's were stored in.

---------- Post added at 12:09 PM ---------- Previous post was at 12:06 PM ----------

It is almost certainly automated. Don't assume however that all checks are carried out by the same people. Many people out there are trying to exploit vulnerable scripts.

1 thing that does surprise me by the sound of it they are manually scanning for wordpress etc. If I were doing this I would personally hook into search engine results to find wordpres installations.

0.0, wow that's kindda frightening knowing that the firewall will crash bcos of too much of log file,
????: NamePros.com http://www.namepros.com/showthread.php?t=719319

btw about the scanning of wordpress sites, maybe bcos hackers recently ( well not that recently ) interested in vulnerabilities in wordpress, i think because of its popularity where thousands of webmasters/bloggers using it.

CrackFeed.Com · 07-09-2011, 06:33 AM

20 in week isn't a DDoS attack. LOL

Perhaps everyone should leave log analysis to the experts. 20 in a week, probably something harmless that you are not aware of.

A DDoS attack is comprised of THOUSANDS and TENS OF THOUSANDS within minutes to hours.

Keep banning ip addresses over foobar and watch as you eventually block the world.

If you secure your server and website software you will need not worry about blocking every ip that does something you do not recognize. There is a lot of legit activity that n00bs will see as "hack attempts" and it is quite humorous.
????: NamePros.com http://www.namepros.com/showthread.php?t=719319

Step One: Stop using open source, if you have access to the vulnerabilities, then the script kiddies do too. Code your own stuff securely and correctly and never give anyone access to that code. That is the best first bet. Also do not use software that requires IONCube, if it is encrypted then you have no idea what the code really says. It could say "come hack my stuff by clicking here" for all you know.

denzuko · 07-09-2011, 07:31 AM

It's not about wordpress, joomla, or drupal.
It's about server security.

They rooted the server.

CrackFeed.Com · 07-09-2011, 07:37 AM

Hey genius, how did they root the server to begin with?

No, there is no evidence based on what the poster said that allow for the assumption that the server has been compromized.

You need to read before you reply.

Quote:

For several weeks now, my Cpanel logs are getting flooded by probing attacks from apparent hackers who seem to be searching if you have wordpress or joomla installed on your domains.

These are bots, nothing more. They are shooting in the dark and if you keep up to date and keep your security tight, they will accomlish nothing. It is no big deal that they do this, if you are secure.

shootdatarget · 07-09-2011, 08:39 AM

lol, roger that... seems i am got lots to learn

????: NamePros.com http://www.namepros.com/showthread.php?t=719319

Originally Posted by DomainerHelper

20 in week isn't a DDoS attack. LOL

Perhaps everyone should leave log analysis to the experts. 20 in a week, probably something harmless that you are not aware of.

A DDoS attack is comprised of THOUSANDS and TENS OF THOUSANDS within minutes to hours.

Keep banning ip addresses over foobar and watch as you eventually block the world.

If you secure your server and website software you will need not worry about blocking every ip that does something you do not recognize. There is a lot of legit activity that n00bs will see as "hack attempts" and it is quite humorous.

Step One: Stop using open source, if you have access to the vulnerabilities, then the script kiddies do too. Code your own stuff securely and correctly and never give anyone access to that code. That is the best first bet. Also do not use software that requires IONCube, if it is encrypted then you have no idea what the code really says. It could say "come hack my stuff by clicking here" for all you know.

fm1234 · 07-09-2011, 08:48 AM

posted by DomainHelper:

Quote:

Step One: Stop using open source ...

But ... your avatar said ...

Peter · 07-09-2011, 04:24 PM

Originally Posted by DomainerHelper

Step One: Stop using open source, if you have access to the vulnerabilities, then the script kiddies do too. Code your own stuff securely and correctly and never give anyone access to that code. That is the best first bet. Also do not use software that requires IONCube, if it is encrypted then you have no idea what the code really says. It could say "come hack my stuff by clicking here" for all you know.

So I take it you have ditched Linux and programmed your own operating system, ditched Apache and coded your own http server, ditched mySQL and coded your own SQL server, ditched PHP and programmed your own language (or better still programmed your sites in machine code or c) .....
????: NamePros.com http://www.namepros.com/showthread.php?t=719319

Programming your own software is not necessarily going to make you secure. You state that if you can view the source so can others and find security holes, that is true but it is also true that those people who find the security hole could report it and it could be fixed quicker.

defaultuser · 07-09-2011, 07:06 PM

Originally Posted by DomainerHelper

Step One: Stop using open source, if you have access to the vulnerabilities, then the script kiddies do too. Code your own stuff securely and correctly and never give anyone access to that code.

It's mighty expensive to code everything yourself and you don't recommend buying code you can't see which makes this the only option. You could trust true third-party apps but I've yet to see evidence that a company product is that much more secure than major open source platforms.
????: NamePros.com http://www.namepros.com/showthread.php?t=719319

Exploitation usually attacks the weakest point of any system - arrogance is one of easiest to spot AND easiest to exploit.

Open source works on the principle that there are more white hat than black hat hackers .. and this is after potentially 100s of people have potentially looked at the source.

I think you're being taken out of context though and you're talking about open source add ons developed by small teams and little review and this is something people should consider. You should be wary of what open source products you are using, stay up to date, and make a few simple changes (you can remove many indications that you are using wordpress/joomla/drupal with a few steps).

Most people get stuck where a poorly supported plugin prevents a major platform upgrade - this is something that crowd sourcing has yet to resolve. Consider even Firefox 5. Most people haven't upgraded due to some "add on". It's security vs other benefits. The other always wins until something happens.

Originally Posted by DomainerHelper

That is the best first bet. Also do not use software that requires IONCube, if it is encrypted then you have no idea what the code really says. It could say "come hack my stuff by clicking here" for all you know.

This is true and important. It also means that you can't fulfill your desire of not sharing code to anyone else. You live in a one programmer / one installation environment because you can't share your code and advise people NOT to use encoded source.

It is essential that people DO NOT USE Templates with encoded source. These things are all over Usenet. Pay the $79 from a legitimate source... IP Theft is the #1 source for hackers to get access to your stuff.

alien51 · 07-23-2011, 11:33 PM

Originally Posted by CrackFeed.Com

These are bots, nothing more. They are shooting in the dark and if you keep up to date and keep your security tight, they will accomlish nothing. It is no big deal that they do this, if you are secure.

Yes, shooting in the dark would be a hint that they're bots. Actually, most of the time my sites return a 404. And then a 403, based on my htaccess retriction settings.
????: NamePros.com http://www.namepros.com/showthread.php?t=719319

But nonetheless, i don't feel comfortable just allowing a bot machine probe my sites over and over again like that with impunity, evenif i'm confident that i'm "secure". I'd rather block the IP and sleep soundly.

texasgamer · 08-08-2011, 06:59 PM

speaking of htaccess what is some good restriction setting to use?

nielsencl · 08-15-2011, 10:28 PM

Glad you asked. We use many lines in our htaccess like:

deny from 1.
deny from 2.
deny from 109.
deny from 110.
deny from 111.
deny from 112.
deny from 113.
deny from 114.
deny from 115.
deny from 116.
deny from 117.21.
deny from 117.22.
deny from 117.23.
deny from 117.24.
deny from 117.25.
etc.

I will attach what we use in case someone else would like to block most non-US traffic to their site. This file has been built by hand over the past couple of years. When I get a spam or attack I check the IP whois and if it is non-us or a hosting company I add the IP range that contains what was used. [Caution: I cannot guarantee that some US ISP IPs won't be included. Use at your own risk or use it as a model to make your own list.]
????: NamePros.com http://www.namepros.com/showthread.php?t=719319

We don't care about non-US traffic so we can just block large IP ranges that for sure not assigned to the US. We also block a lot of hosting company IP ranges. We do this on sites, but we also do this at the sever level for some accounts. We had CSF installed and block the same ranges, but with notation like "109.0.0.0/8".

When a country can't access your server or use it to relay spam, it really helps.

alien51 · 09-27-2011, 12:18 AM

Originally Posted by nielsencl

When I get a spam or attack I check the IP whois and if it is non-us or a hosting company I add the IP range that contains what was used....... We don't care about non-US traffic so we can just block large IP ranges that for sure not assigned to the US.

I sometimes do the same thing, example for the past 3 years almost all of the spam and hack bots i see on my logs come from Ukraine.
????: NamePros.com http://www.namepros.com/showthread.php?t=719319

There are also the Adsense-click-friendly countries to block.

Sometimes, however, i wonder if this is some kind of racial discrimination. lol

BY THE WAY......

My domains are being hammered repeatedly by this:

"/shop/admin/banner_manager.php/login.php?action=insert"

Any of you seeing this often as well??????

It's a good thing most of my domains are just 1-page plain HTML "for sale" pages. lol

06-17-2011, 09:40 AM	THREAD STARTER #1 (permalink)
alien51 NamePros Regular Join Date: Oct 2008 Location: Sector 7G, Alpha Centauri Posts: 844	Hacking probes everywhere.... For several weeks now, my Cpanel logs are getting flooded by probing attacks from apparent hackers who seem to be searching if you have wordpress or joomla installed on your domains. And they come from all sorts of countries. My banned ip address list on my htaccess is so long already. It's eating up too much of my time just checking the logs each day for all my domains. I sometimes wonder whether these are zombie machines (users who had no idea their computers are infected and being used for probing attacks).

06-17-2011, 09:51 AM	#2 (permalink)
maxeaus Senior Member Join Date: Aug 2008 Location: Australia Posts: 1,800	Botnets, is that what you are saying? __________________ Drez Media

06-17-2011, 10:00 AM	#3 (permalink)
vc NamePros Regular Join Date: Sep 2010 Posts: 289	Use Drupal __________________ vanilla.me - New/Transfer/Renew: $15 - The sweetest ccTLD Registrar

06-30-2011, 07:56 PM	#10 (permalink)
herly New Member Join Date: Jun 2011 Posts: 20	Can only pray don't let hackers target. Because that's a very fearful thing, what will become of very bad. __________________ yourshoeshow shoes of city.charmjerseys,clothes of city.

07-09-2011, 06:33 AM	#13 (permalink)
CrackFeed.Com Account Suspended Join Date: Dec 2008 Location: Boston, Ma Posts: 650 Follow @CrackFeed	20 in week isn't a DDoS attack. LOL Perhaps everyone should leave log analysis to the experts. 20 in a week, probably something harmless that you are not aware of. A DDoS attack is comprised of THOUSANDS and TENS OF THOUSANDS within minutes to hours. Keep banning ip addresses over foobar and watch as you eventually block the world. If you secure your server and website software you will need not worry about blocking every ip that does something you do not recognize. There is a lot of legit activity that n00bs will see as "hack attempts" and it is quite humorous. ????: NamePros.com http://www.namepros.com/showthread.php?t=719319 Step One: Stop using open source, if you have access to the vulnerabilities, then the script kiddies do too. Code your own stuff securely and correctly and never give anyone access to that code. That is the best first bet. Also do not use software that requires IONCube, if it is encrypted then you have no idea what the code really says. It could say "come hack my stuff by clicking here" for all you know. Last edited by CrackFeed.Com; 07-09-2011 at 06:44 AM.

06-17-2011, 06:38 PM	THREAD STARTER #5 (permalink)
alien51 NamePros Regular Join Date: Oct 2008 Location: Sector 7G, Alpha Centauri Posts: 844	I'm not sure if being "automated" means the guy who owns the machine where the IP address originated was unaware that the probing came from his IP. I'm not sure anymore if i need to block all these IP addresses, or just let the 403 errors as they are (my htaccess settings prevent execution of php scripts in certain directories). I've been blocking IP addresses almost everyday.

06-22-2011, 02:22 PM	#8 (permalink)
CrackFeed.Com Account Suspended Join Date: Dec 2008 Location: Boston, Ma Posts: 650 Follow @CrackFeed	loll would perform faster than Drupal and Joomla

07-09-2011, 07:31 AM	#14 (permalink)
denzuko NamePros Regular Join Date: Jan 2010 Posts: 207	It's not about wordpress, joomla, or drupal. It's about server security. They rooted the server. __________________ My Blog

08-08-2011, 06:59 PM	#21 (permalink)
texasgamer Senior Member Join Date: Jan 2006 Location: Corpus Christi, Texas Posts: 2,373	speaking of htaccess what is some good restriction setting to use? __________________ Sara Palin

08-15-2011, 10:28 PM	#22 (permalink)
nielsencl Senior Member Join Date: Jul 2006 Location: Minneapolis Posts: 2,516	Glad you asked. We use many lines in our htaccess like: deny from 1. deny from 2. deny from 109. deny from 110. deny from 111. deny from 112. deny from 113. deny from 114. deny from 115. deny from 116. deny from 117.21. deny from 117.22. deny from 117.23. deny from 117.24. deny from 117.25. etc. I will attach what we use in case someone else would like to block most non-US traffic to their site. This file has been built by hand over the past couple of years. When I get a spam or attack I check the IP whois and if it is non-us or a hosting company I add the IP range that contains what was used. [Caution: I cannot guarantee that some US ISP IPs won't be included. Use at your own risk or use it as a model to make your own list.] ????: NamePros.com http://www.namepros.com/showthread.php?t=719319 We don't care about non-US traffic so we can just block large IP ranges that for sure not assigned to the US. We also block a lot of hosting company IP ranges. We do this on sites, but we also do this at the sever level for some accounts. We had CSF installed and block the same ranges, but with notation like "109.0.0.0/8". When a country can't access your server or use it to relay spam, it really helps. __________________ Lorraine Bowman - Internet Expert Witness - Bankrupture - Ad Creation Marketplace - How To Sell Domain Name Last edited by nielsencl; 01-26-2012 at 09:52 PM.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
SEC probes AOL	netcheap	Industry News	1	08-02-2003 09:52 AM

Hacking probes everywhere....

hacking issues